@bongos/core 1.21.46 → 1.21.48

package/tests/hall_street_desk.mjs

@@ -327,6 +327,7 @@ test('the page: the desk acts in place — the row clears, the floor lights with
   assert.deepEqual(p.sent, [{ method: 'PATCH', url: '/api/bongos/access-requests/11', body: { status: 'invited' } }], 'the card\'s own route, nothing else');
   assert.match(p.byId.get('streetToast').textContent, /Ana Ruiz is invited in/);
   assert.equal(p.byId.get('streetToast').hidden, false);
+  assert.match(p.byId.get('streetToast').className, /street-toast--desk/, "the desk's own toast, as on the board (task 1004562)");
   assert.equal(p.byId.get('streetTodayN').textContent, '1 decided');
   assert.equal(p.byId.get('streetTodayPips').children.filter((x) => x.className.includes('--on')).length, 1, 'one pip per decision');
   assert.equal(JSON.parse(p.store.get('gov-desk-today')).n, 1, 'the day keeps its count');
@@ -624,6 +625,12 @@ test('Release: the core update is checked first; take is offered only after a pa
   assert.equal(C.request(passed.card, 'take', {}), null, 'no version chip, no move');
   assert.deepEqual(coreRoute.coreDeskRows({ ...PREVIEW, open_intent: { state: 'running' } }), [], 'a run in progress offers nothing');
   assert.deepEqual(coreRoute.coreDeskRows({ ...PREVIEW, behind: false }), []);
+  // the stand-in keeps what it stands for: the core update needs you, so the
+  // desk says so in orange, as the floor's sign and the street's count do (task 1004562)
+  const desk = D.deskModel({ key: 'release', floor: 3, docket: moreDesks({ preflight: null }), goals: GOALS, now: NOW, viewerId: '95' });
+  assert.equal(desk.hot, true);
+  assert.match(desk.status, /^1 update/);
+  assert.deepEqual(D.breaks(desk), []);
 });
 
 test('Rules: the rot timer as day chips, work categories as a link, modules on in one tap and off with a yes', () => {
@@ -747,10 +754,11 @@ test('Ideas to ratify: a promise ratifies in one tap; a carried Full Idea become
   const dk = planningDocket();
   const rows = D.rowsFor('planning', 1, dk, { now: NOW, goals: GOALS });
   const promise = rows.find((r) => r.name === 'Calm mode promise');
-  assert.deepEqual(promise.actions.map((a) => a.label), ['ratify', 'open']);
+  assert.deepEqual(promise.actions.map((a) => a.label), ['ratify'], 'a row that acts here keeps its detail in place: no link out (task 1004562)');
+  assert.ok(promise.facts.length >= 1, 'its detail opens in place');
   assert.deepEqual(j(C.request(promise.card, 'ratify')), { method: 'POST', url: '/api/bongos/inbox/5/ratify', body: { notes_md: 'Ratified on the floor desk.' } });
   const full = rows.find((r) => r.name === 'Objection goes back');
-  assert.deepEqual(full.actions.map((a) => a.label), ['make goal', 'open']);
+  assert.deepEqual(full.actions.map((a) => a.label), ['make goal'], 'no link out beside an act');
   assert.deepEqual(full.choices.ratify_goal.options.map((o) => o.label), ['V2', 'V3'], 'the target version is a chip');
   assert.deepEqual(j(C.request(full.card, 'ratify_goal', full.choices.ratify_goal.options[1].input)), { method: 'POST', url: '/api/bongos/inbox/6/ratify-goal', body: { target_version: 'V3', notes_md: 'Ratified on the floor desk.' } });
   assert.ok(!rows.some((r) => r.name === 'Still sitting'), 'a Full Idea the board has not carried is not ratified from here');
@@ -832,3 +840,57 @@ test('the page: one tap on its option decides a blocker, its options standing op
   assert.deepEqual(p.sent, [{ method: 'POST', url: '/api/bongos/blockers/12/resolve', body: { resolution_note: 'Decided on the floor desk: Paddle.' } }]);
   assert.match(p.byId.get('streetToast').textContent, /Decided/);
 });
+
+// ── the live walkthrough's differences (task 1004562) ─────────────────────────
+function floorRow(key, count, line) {
+  return { key, building: key.split('.')[0], status: 'live', count, line, lines: [], hot: false, reason: null };
+}
+test('walkthrough: a quiet floor\'s tile says what its number counts, in two words that read as a label', () => {
+  const dk = docket([], { history: [], floors: [
+    floorRow('people.testers', '3', 'Lu, Bo and Ines'),
+    floorRow('people.council', '5', '5 seats · no term yet'),
+    floorRow('people.newcomers', '2', '2 newcomer tasks being built'),
+    floorRow('release.live_month', '1', '1 piece of work went live'),
+    floorRow('review.signed_off', '2', '2 signed off this month'),
+  ] });
+  const tile = (key, floor) => D.deskModel({ key, floor, docket: dk, now: NOW }).tiles.map((t) => t.v + ' ' + t.l);
+  assert.deepEqual(tile('people', 1), ['3 testers'], 'a line that is not a count names nothing: the floor does');
+  assert.deepEqual(tile('people', 0), ['5 seats'], 'the line\'s own noun when it follows the same number');
+  assert.deepEqual(tile('people', 3), ['2 newcomers'], 'a long line: the floor\'s name');
+  assert.deepEqual(tile('release', 4), ['1 went live'], 'a long line under a long name: its last two words');
+  assert.deepEqual(tile('review', 2), ['2 signed off']);
+});
+test('walkthrough: a cleared floor shows no count of the work just done, and says its own clear line', () => {
+  const m = matter({ id: 'removal_proposals:61', source: 'removal_proposals', building: 'disputes', state: 'needs', title: 'Old search page', ref: { id: 61 } });
+  const dk = docket([m], { history: [], floors: [floorRow('disputes.removals', '2', '1 needs you')] });
+  const desk = D.deskModel({ key: 'disputes', floor: 1, docket: dk, now: NOW, done: { 'removal_proposals:61': true }, cleared: true, today: 2 });
+  assert.equal(desk.cleared, true);
+  assert.deepEqual(desk.tiles, [], 'no "2 needs you" tile on a floor you just cleared');
+  assert.deepEqual([desk.status, desk.clearLine, desk.clearSub], ['floor clear', 'No removals asked', 'lit up · 2 decided today']);
+  assert.deepEqual(D.breaks(desk), []);
+  // with a tool left on the floor (the invite), the status does not repeat the stale count
+  const join = matter({ id: 'access_requests:7', source: 'access_requests', building: 'people', state: 'needs', proposer: { name: 'Builder 4' }, ref: { id: 7 } });
+  const invite = { key: 'people.invite', status: 'live', rows: [{ id: 'people.invite:new', desk: 'people.invite', building: 'people', name: 'Invite someone', fact: 'by their GitHub name', facts: [], needs: false, tool: true, ref: { type: 'invite', id: 'new' }, acts: [{ key: 'invite', field: 'login' }] }] };
+  const left = D.deskModel({ key: 'people', floor: 4, docket: docket([join], { history: [], desks: [invite], floors: [floorRow('people.join', '1', '1 needs you')] }), now: NOW, done: { 'access_requests:7': true } });
+  assert.deepEqual(left.rows.map((r) => r.name), ['Invite someone']);
+  assert.equal(left.status, 'nothing needs you');
+  assert.equal(left.hot, false);
+});
+test('walkthrough: a count agrees with its noun, in the status and on the tile', () => {
+  const votes = [1, 2].map((n) => matter({ id: 'board:' + n, source: 'board', building: 'charter', state: 'needs', title: 'Vote ' + n }));
+  const two = D.deskModel({ key: 'charter', floor: 0, docket: docket(votes, { history: [] }), now: NOW });
+  assert.match(two.status, /^2 open votes · oldest/);
+  assert.deepEqual(two.tiles.map((t) => t.v + ' ' + t.l), ['2 open votes']);
+  const one = D.deskModel({ key: 'charter', floor: 0, docket: docket(votes.slice(0, 1), { history: [] }), now: NOW });
+  assert.match(one.status, /^1 open vote · oldest/);
+});
+test('walkthrough: a record item keeps its age, and what you did keeps its "now"', () => {
+  const hist = [
+    { id: 'a', building: 'release', title: 'The new sign-up', outcome: 'live', at: '2026-10-01T12:00:00.000Z' },
+    { id: 'b', building: 'release', title: 'Mira holds the Treasurer seat', outcome: 'granted', at: '2026-09-12T12:00:00.000Z' },
+    { id: 'c', building: 'release', title: 'Today it went out', outcome: '', at: '2026-10-03T09:00:00.000Z' },
+  ];
+  const desk = D.deskModel({ key: 'release', floor: 2, docket: docket([], { history: hist }), now: NOW, mine: ['voted yes A returned idea carries it back'] });
+  assert.deepEqual(desk.record.map((x) => x.text), ['voted yes A returned id… · now', 'The new sign-up · live · 2d', 'Mira holds the Treasurer… · 3w', 'Today it went out · today']);
+  assert.ok(desk.record.every((x) => x.text.length <= D.LIMITS.recordLen));
+});

package/tests/instance_config.mjs

@@ -235,3 +235,56 @@ test('resolveApiBase: session:null does not read the session file from disk', ()
   // and callers that already know there is no session get a deterministic answer.
   assert.equal(ic.resolveApiBase({ session: null, env: {}, b: BRAND_B }), 'https://instance-b.example');
 });
+
+// ── task 1004573: the platform's BONGOS_* spelling is always heard ────────────
+// The platform writes every hosted project's web.env as BONGOS_*. Mercury's adopted
+// config/branding.json said envPrefix CLOUDBONGOS, so it read none of it — not its
+// sign-in credentials, not its address, not one setting (live, 2026-10-04).
+
+test('resolveEnv: a pack naming another prefix still reads the platform\'s BONGOS_* (task 1004573)', () => {
+  const env = { BONGOS_GITHUB_CLIENT_ID: 'Iv23-platform' };
+  assert.equal(resolveEnv('GITHUB_CLIENT_ID', { prefix: 'CLOUDBONGOS', env, warn: () => {}, warnPack: () => {} }), 'Iv23-platform');
+  assert.equal(resolveEnv('GITHUB_CLIENT_ID', { prefix: 'OTB', env, warn: () => {}, warnPack: () => {} }), 'Iv23-platform');
+});
+
+test('resolveEnv: the pack\'s own spelling still WINS over the platform\'s (task 1004573)', () => {
+  const env = { CLOUDBONGOS_PUBLIC_ORIGIN: 'https://own.example', BONGOS_PUBLIC_ORIGIN: 'https://platform.example' };
+  assert.equal(resolveEnv('PUBLIC_ORIGIN', { prefix: 'CLOUDBONGOS', env, warn: () => {}, warnPack: () => {} }), 'https://own.example');
+});
+
+test('resolveEnv: BONGOS_* is read BEFORE the legacy list, and is never called deprecated (task 1004573)', () => {
+  const legacyWarnings = [];
+  const v = resolveEnv('JOINABILITY', { prefix: 'OTB', env: { BONGOS_JOINABILITY: 'open', PMS_JOINABILITY: 'closed' }, warn: (w) => legacyWarnings.push(w), warnPack: () => {} });
+  assert.equal(v, 'open', 'the canonical platform spelling beats a legacy one');
+  assert.ok(!legacyWarnings.some((w) => /^BONGOS_/.test(w.legacyName)), 'BONGOS_ is the canonical name — no deprecation warning names it');
+});
+
+test('resolveEnv: when it has to read BONGOS_*, it says to fix the pack — and only then (task 1004573)', () => {
+  const calls = [];
+  const warnPack = (w) => calls.push(w);
+  resolveEnv('LOOK', { prefix: 'CLOUDBONGOS', env: { BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  assert.deepEqual(calls, [{ prefix: 'CLOUDBONGOS', name: 'BONGOS_LOOK' }], 'names the pack prefix and the name it fell back to');
+  resolveEnv('LOOK', { prefix: 'CLOUDBONGOS', env: { CLOUDBONGOS_LOOK: 'x', BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  resolveEnv('LOOK', { prefix: 'BONGOS', env: { BONGOS_LOOK: 'own' }, warn: () => {}, warnPack });
+  assert.equal(calls.length, 1, 'silent when the pack\'s own spelling won, and when the pack is already BONGOS');
+});
+
+test('resolveEnv: the default pack warning names the fix, once per process (task 1004573)', () => {
+  const seen = [];
+  const orig = console.warn;
+  console.warn = (m) => seen.push(String(m));
+  try {
+    // the default warnPack — the real wiring, not a hand-called helper
+    resolveEnv('ONE', { prefix: 'CLOUDBONGOS', env: { BONGOS_ONE: '1' }, warn: () => {} });
+    resolveEnv('TWO', { prefix: 'CLOUDBONGOS', env: { BONGOS_TWO: '2' }, warn: () => {} });
+  } finally { console.warn = orig; }
+  const lines = seen.filter((m) => /envPrefix "CLOUDBONGOS"/.test(m));
+  assert.equal(lines.length, 1, 'one line, not one per setting');
+  assert.match(lines[0], /BONGOS_ONE/);
+  assert.match(lines[0], /Set envPrefix to "BONGOS"/);
+});
+
+test('resolveEnv: a pack already on BONGOS is unchanged (task 1004573)', () => {
+  assert.equal(resolveEnv('X', { prefix: 'BONGOS', env: { BONGOS_X: 'a', PMS_X: 'b' }, warn: () => {}, warnPack: () => {} }), 'a');
+  assert.equal(resolveEnv('X', { prefix: 'BONGOS', env: {}, warn: () => {}, warnPack: () => {} }), undefined);
+});

package/tests/instance_feedback.mjs

@@ -312,6 +312,18 @@ test('the skill files unasked on a Bongos rant, and the kernel tells every sessi
   assert.match(kernel, /vents that Bongos itself is broken.*\/bongos-feedback/);
 });
 
+// task 1004576: "Bongos feedback: …" (a calm wish, not a rant) fired no skill — the
+// listing only described venting, and a since-deleted /feedback skill owned the phrase.
+test('a labelled message or a wish about Bongos triggers the skill too, and nothing else claims the phrase', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude/skills/bongos-feedback/SKILL.md'), 'utf8');
+  const description = skill.split('\n---')[0];
+  assert.match(description, /Bongos feedback:/, 'the literal label is a trigger');
+  assert.match(description, /Bongos should/, 'a wish is a trigger');
+  assert.match(skill, /Suggestions count/);
+  assert.match(skill, /\*\*is\*\* the go/, 'a labelled message is sent without a second ask');
+  assert.ok(!fs.existsSync(path.join(ROOT, '.claude/skills/feedback')), 'no second skill competes for "feedback"');
+});
+
 test('every report is secret-scrubbed before it leaves the machine, and never sent unscrubbed', async () => {
   const { scrubReport } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
   const token = 'ghp_' + 'a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8';

package/tests/provision.mjs

@@ -1330,6 +1330,59 @@ await ta('scaffoldStandaloneRepo(adopt): does NOT clobber an existing .gitignore
   assert.match(String(gi.body), /node_modules\//, 'and the entries `npm ci` + the deploy require are added');
 });
 
+// Task 1004573: adopt layers config only where ABSENT, so an owner's config/branding.json
+// kept whatever envPrefix it carried while web.env was written under the platform's —
+// mercury's said CLOUDBONGOS and read none of its credentials or settings.
+async function adoptWithPack(packText, mode = 'adopt') {
+  const base = mkdtempSync(join(tmpdir(), `pack-${mode}-`));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    mkdirSync(join(base, 'demo', 'config'), { recursive: true });
+    writeFileSync(join(base, 'demo', 'config', 'branding.json'), packText);
+    const { deps } = recorder({ apply: true });
+    const seq = [];
+    deps.exec = (cmd) => { seq.push(`exec ${cmd}`); return { ok: true, stdout: '' }; };
+    deps.writeFile = (p, body) => { seq.push(`write ${p}`); seq.writes = (seq.writes || []).concat([{ p, body }]); return { ok: true }; };
+    deps.getGithubToken = async () => ({ token: 'gho_TOK', scope: 'repo' });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'cloud-host', target_ref: 'example-owner/demo', owner_builder_id: 7, onboard_mode: mode },
+      { ...deps, instanceRoot: base },
+    );
+    return { seq, writes: seq.writes || [] };
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+}
+const U2 = require('../scripts/gds/provision-units.js');
+
+await ta('scaffoldStandaloneRepo(adopt): an owner pack on another envPrefix is corrected IN the adopt commit (task 1004573)', async () => {
+  const owner = '{\n  "identity": { "productName": "mercury" },\n  "envPrefix": "CLOUDBONGOS",\n  "configDir": "cloudbongos"\n}\n';
+  const { seq, writes } = await adoptWithPack(owner);
+  const w = writes.find((x) => /config\/branding\.json$/.test(x.p));
+  assert.ok(w, 'the pack was rewritten');
+  assert.equal(JSON.parse(w.body).envPrefix, U2.provisionedEnvPrefix(), 'to the prefix web.env is written under');
+  assert.equal(w.body, owner.replace('"envPrefix": "CLOUDBONGOS"', `"envPrefix": "${U2.provisionedEnvPrefix()}"`), 'and NOTHING else in the owner\'s file moved');
+  const wrote = seq.findIndex((s) => /^write .*config\/branding\.json$/.test(s));
+  const added = seq.findIndex((s) => /git -C \S+ add -A/.test(s));
+  assert.ok(wrote >= 0 && added > wrote, 'written before `git add -A`, so it rides the adopt commit to the owner\'s repo');
+});
+
+await ta('scaffoldStandaloneRepo: a pack that already agrees, and a greenfield scaffold, are left alone (task 1004573)', async () => {
+  const agree = await adoptWithPack(JSON.stringify({ envPrefix: U2.provisionedEnvPrefix() }));
+  assert.ok(!agree.writes.some((x) => /config\/branding\.json$/.test(x.p)), 'agreeing pack untouched');
+  const green = await adoptWithPack(JSON.stringify({ envPrefix: 'CLOUDBONGOS' }), 'greenfield');
+  assert.ok(!green.writes.some((x) => /config\/branding\.json$/.test(x.p)), 'greenfield owns its config through init; no rewrite here');
+});
+
+await ta('normalizePackEnvPrefix: rewrites only the value, refuses what it cannot rewrite safely (task 1004573)', async () => {
+  assert.deepEqual(U2.normalizePackEnvPrefix('{"envPrefix":"OTB","x":1}', 'BONGOS'), { text: '{"envPrefix":"BONGOS","x":1}', from: 'OTB' });
+  assert.equal(U2.normalizePackEnvPrefix('{"envPrefix":"BONGOS"}', 'BONGOS'), null);
+  assert.equal(U2.normalizePackEnvPrefix('{"identity":{}}', 'BONGOS'), null, 'no envPrefix → nothing to correct');
+  assert.equal(U2.normalizePackEnvPrefix('not json', 'BONGOS'), null);
+});
+
 await ta('scaffoldStandaloneRepo(adopt): a default branch that is not `main` fails LOUDLY, not silently', async () => {
   // The rest of provisioning is main-only (git pull --ff-only origin main; the box deploy
   // does git reset --hard origin/main), so layering onto another branch would push somewhere
@@ -1776,6 +1829,56 @@ await ta('a failure BEFORE GitHub handed over credentials claims no App (task 10
   assert.ok(resolves.every((x) => !('app_slug' in x.patch)), 'no App is named when none was handed over');
 });
 
+// Task 1004573: an adopted repo brings its own config/branding.json. Mercury's said
+// envPrefix CLOUDBONGOS while the platform wrote BONGOS_*, so the project never saw
+// its credentials — and the only thing anyone was told was "did not report sign-in
+// ready". When the check fails, the runner now reads the pack and names a mismatch.
+const U = require('../scripts/gds/provision-units.js');
+
+await ta('envPrefixMismatch names a pack that reads other names, and nothing else (task 1004573)', async () => {
+  const m = U.envPrefixMismatch(JSON.stringify({ envPrefix: 'CLOUDBONGOS' }), 'BONGOS');
+  assert.match(m, /reads settings named CLOUDBONGOS_\*, but the platform wrote BONGOS_\*/);
+  assert.match(m, /set its envPrefix to "BONGOS"/);
+  assert.equal(U.envPrefixMismatch(JSON.stringify({ envPrefix: 'BONGOS' }), 'BONGOS'), null, 'agreeing names say nothing');
+  assert.equal(U.envPrefixMismatch(JSON.stringify({ identity: {} }), 'BONGOS'), null, 'a pack with no envPrefix claims nothing');
+  assert.equal(U.envPrefixMismatch('not json', 'BONGOS'), null, 'an unreadable pack claims nothing');
+  assert.equal(U.envPrefixMismatch(null, 'BONGOS'), null);
+});
+
+await ta('a sign-in check that fails on a mismatched pack SAYS so (task 1004573)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'cloud-host', slug: 'mercury', domain: 'mercury.example.com' };
+  const cmds = [], reads = [];
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
+    exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: '{"ok":true,"auth_configured":false}' }; },
+    readFile: (p) => { reads.push(p); return JSON.stringify({ envPrefix: 'CLOUDBONGOS' }); },
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /credentials are placed/, 'still owns what DID happen');
+  assert.match(r.error, /reads settings named CLOUDBONGOS_\*, but the platform wrote/, 'and names the cause');
+  assert.deepEqual(reads, [join(P.standaloneRoot(inst), 'config', 'branding.json')], 'reads the project\'s OWN pack, from its checkout');
+  assert.ok(!cmds.some((c) => /branding\.json/.test(c)), 'a plain file read — no shell command carries the path');
+});
+
+await ta('a sign-in check that fails with agreeing names keeps the plain message (task 1004573)', async () => {
+  const inst = { ...coTenant, hosting_shape: 'cloud-host', domain: 'mercury.example.com' };
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 1, appSlug: 's' }),
+    exec: () => ({ ok: true, stdout: '{"ok":true,"auth_configured":false}' }),
+    readFile: () => JSON.stringify({ envPrefix: U.provisionedEnvPrefix() }),
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.error, 'the credentials are placed, but the project did not report sign-in ready in time');
+  // an unreadable pack names nothing either
+  const r2 = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, { ...deps, readFile: () => { throw new Error('ENOENT'); } });
+  assert.equal(r2.error, 'the credentials are placed, but the project did not report sign-in ready in time');
+});
+
 await ta('a PRE-conversion failure stays retryable — the narrowing spared the retry path (F23)', async () => {
   let claims = 0; const resolves = [];
   const deps = {

package/tests/skill_menu_ruling.mjs

@@ -19,7 +19,7 @@ const read = (n) => fs.readFileSync(byName.get(n), 'utf8');
 const info = (n) => lint.lintSkillFile(read(n), { file: byName.get(n) });
 
 // The ruling, as written into the task.
-const LISTED_TRIMMED = ['grade-recover', 'collab-review', 'session-handoff', 'builder-claim', 'builder-sequence', 'blocker-solve', 'design', 'goal-create', 'blocker-review', 'builder-reauth', 'read-session-export', 'recall', 'worktree-clean', 'merge-mode', 'builder-setup', 'builder-key', 'bongos-feedback', 'feedback', 'builder-redteam', 'scan-before-install', 'owner-review'];
+const LISTED_TRIMMED = ['grade-recover', 'collab-review', 'session-handoff', 'builder-claim', 'builder-sequence', 'blocker-solve', 'design', 'goal-create', 'blocker-review', 'builder-reauth', 'read-session-export', 'recall', 'worktree-clean', 'merge-mode', 'builder-setup', 'builder-key', 'bongos-feedback', 'builder-redteam', 'scan-before-install', 'owner-review'];
 const LISTED_AS_IS = ['strand-fix', 'builder-ship', 'builder-start', 'fix-task', 'ask-for-help', 'ship-check', 'status', 'builder-end', 'builder-release', 'builder-stage'];
 const HIDDEN = ['planning-session', 'goal-close', 'grade-sweep', 'builder-exit', 'builder-backup', 'builder-cost', 'new-project', 'design-sync', 'figma-design-sync', 'tweak'];
 const ALIASES = ['backlog-review', 'bug-triage', 'idea-triage', 'priority-session', 'goal-uat', 'goal-review', 'grade-audit', 'grader-health'];

package/.claude/skills/feedback/SKILL.md

@@ -1,39 +0,0 @@
----
-name: feedback
-description: >-
-  Pull the latest Bongos feedback bundle (walkthrough transcript, screenshots) into this session; read-only. Triggers: "/feedback", "pull in my latest feedback", "load my bongos feedback", "I just recorded a walkthrough", "act on my screen recording".
-plain: >-
-  Loads your most recent recorded walkthrough, what you said and the screenshots, into this conversation.
-reach-for: >-
-  Right after you have recorded feedback on the project and want your assistant to act on it.
-cost: >-
-  Free, and it changes nothing. It only reads files on your computer.
----
-
-You are pulling in the **latest Bongos feedback bundle** — a self-contained capture the user just recorded with the Bongos desktop app (BV1.R13 / [ADR 0087](../../../docs/adr/0087-bongos-app-architecture-and-handoff-contract.md)). The app turns a spoken screen walkthrough into a model-agnostic `prompt.md` (a timestamped transcript + an ask) plus a handful of screenshots, all under `~/CloudBongos/feedback/`. This skill loads that bundle so you can act on it directly — no copy-paste, no clipboard-image fiddling.
-
-## Steps
-
-1. **Resolve + print the latest bundle:**
-
-   ```bash
-   node scripts/gds/feedback-latest.js
-   ```
-
-   This prints the full `prompt.md` body followed by an `attached frames` list — one **absolute image path** per line. (Add `--json` if you want structured output instead.)
-
-2. **If it says "No feedback bundle found"** — tell the user there's nothing to load yet: record a walkthrough in the Bongos app and stop the capture (that writes the bundle), then run `/feedback` again. Stop here.
-
-3. **Read every listed frame.** For each absolute path under `attached frames`, call the **Read** tool on it so the screenshots enter your context as images. The paths are real files on disk — Read them directly; do not ask the user to paste anything.
-
-4. **Act on the bundle.** Treat the transcript in `prompt.md` as the request and the screenshots as ground truth for what the user was looking at (the timestamps line the words up with the images). Work out what they want changed or fixed and do it. Ask a question only if you are genuinely blocked.
-
-## Notes
-
-- **Read-only + local.** The helper only reads files under `~/CloudBongos/feedback/`; it needs no Bongos session and no network.
-- **"Latest" = most recently produced.** The Bongos app updates a `latest` pointer every time a capture is stopped, so this always loads the newest walkthrough. To act on an older one, point the user at the specific dir under `~/CloudBongos/feedback/`.
-- **The frames are file paths, never base64** — that's the whole point of the bundle format (it keeps the text prompt tiny and lets your Read tool load the images). See [ADR 0087](../../../docs/adr/0087-bongos-app-architecture-and-handoff-contract.md) for the full bundle contract.
-
-## Files this skill touches
-
-- Runs: `node scripts/gds/feedback-latest.js` (resolves the ADR 0087 `latest` pointer itself — the app source is off-repo, ADR 0098).

package/scripts/bongos-mcp.js

@@ -1,28 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos-mcp.js — R14 launcher for the Bongos feedback MCP server.
-//
-// This is the entry point a Claude MCP config points at. The server itself
-// lives in bongos-app/src/mcp-server.js (bundled with the app); this thin
-// launcher lets it run from a repo checkout / a stable path without depending
-// on the app's process.
-//
-// Register it with Claude Code:
-//   claude mcp add bongos-feedback -- node /ABSOLUTE/PATH/scripts/bongos-mcp.js
-//
-// Or in a Claude Desktop / Code MCP config:
-//   { "mcpServers": { "bongos-feedback": {
-//       "command": "node",
-//       "args": ["/ABSOLUTE/PATH/scripts/bongos-mcp.js"] } } }
-//
-// Then call the get_latest_feedback tool to pull the latest bundle (prompt text
-// + screenshot file paths). See bongos-app/README.md for the full contract.
-
-'use strict';
-
-const path = require('node:path');
-const { main } = require(path.join(__dirname, '..', 'bongos-app', 'src', 'mcp-server.js'));
-
-main().catch((err) => {
-  process.stderr.write(`bongos-mcp: ${err.message}\n`);
-  process.exit(1);
-});

package/scripts/gds/feedback-latest.js

@@ -1,224 +0,0 @@
-#!/usr/bin/env node
-// scripts/gds/feedback-latest.js — R13 (BV1.R13): the engine behind the
-// /feedback Claude Code slash command.
-//
-// Resolves the LATEST feedback bundle the Bongos app wrote to
-// ~/CloudBongos/feedback/ (via the shared `latest` pointer, ADR 0087) and
-// prints it for a Claude Code session:
-//
-//   1. the full prompt.md body (the model-agnostic transcript + ask, R11), and
-//   2. the ABSOLUTE path of every attached frame, on its own line, so Claude's
-//      Read tool can load each image directly.
-//
-// This sidesteps the CLI's unreliable clipboard-image paste: Claude reads the
-// frames from disk by path instead of from a pasted blob.
-//
-// Usage:
-//   node scripts/gds/feedback-latest.js            # human/agent-readable dump
-//   node scripts/gds/feedback-latest.js --json     # { id, dir, promptMarkdown, imagePaths }
-//   node scripts/gds/feedback-latest.js --base DIR # override bundle base dir (tests)
-//
-// Local + read-only: it reads files under your home dir. No GDS session, no
-// network — so it works on any machine the Bongos app runs on.
-//
-// resolveLatest + feedbackBaseDir are ported here from the app's
-// bongos-app/src/handoff.js, which no longer lives in this repo (the desktop
-// apps publish off-repo, ADR 0098 — task 1004356). The contract is ADR 0087's:
-// `latest.json` is authoritative, the `latest/` symlink is a convenience that
-// may be absent, and with neither the reader self-heals by scanning for the
-// newest bundle dir holding a prompt.md.
-
-'use strict';
-
-const fs = require('node:fs/promises');
-const os = require('node:os');
-const path = require('node:path');
-
-const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
-
-/** Where the Bongos app writes bundles: ~/CloudBongos/feedback. */
-function feedbackBaseDir() {
-  return path.join(os.homedir(), 'CloudBongos', 'feedback');
-}
-
-async function isBundleDir(dir) {
-  try {
-    return (await fs.stat(path.join(dir, 'prompt.md'))).isFile();
-  } catch {
-    return false;
-  }
-}
-
-// The dir `latest.json` names, or null if it is missing, unreadable or stale.
-// Accepts the pointer by `dir` (absolute) or by `id` (a child of baseDir).
-async function fromPointer(baseDir) {
-  let ptr;
-  try {
-    ptr = JSON.parse(await fs.readFile(path.join(baseDir, 'latest.json'), 'utf8'));
-  } catch {
-    return null;
-  }
-  if (!ptr || typeof ptr !== 'object') return null;
-  const candidates = [];
-  if (typeof ptr.dir === 'string' && ptr.dir) candidates.push(path.resolve(baseDir, ptr.dir));
-  if (typeof ptr.id === 'string' && ptr.id && !/[\\/]/.test(ptr.id)) candidates.push(path.join(baseDir, ptr.id));
-  for (const dir of candidates) if (await isBundleDir(dir)) return dir;
-  return null;
-}
-
-async function fromSymlink(baseDir) {
-  const link = path.join(baseDir, 'latest');
-  if (!(await isBundleDir(link))) return null;
-  try {
-    return await fs.realpath(link);
-  } catch {
-    return null;
-  }
-}
-
-// Self-heal: the newest child dir (by prompt.md mtime, then name) with a prompt.md.
-async function fromScan(baseDir) {
-  let entries;
-  try {
-    entries = await fs.readdir(baseDir, { withFileTypes: true });
-  } catch {
-    return null;
-  }
-  let best = null;
-  for (const e of entries) {
-    if (!e.isDirectory() || e.name === 'latest') continue;
-    const dir = path.join(baseDir, e.name);
-    let st;
-    try {
-      st = await fs.stat(path.join(dir, 'prompt.md'));
-    } catch {
-      continue;
-    }
-    if (!st.isFile()) continue;
-    if (!best || st.mtimeMs > best.mtimeMs || (st.mtimeMs === best.mtimeMs && e.name > best.name)) {
-      best = { dir, name: e.name, mtimeMs: st.mtimeMs };
-    }
-  }
-  return best && best.dir;
-}
-
-// The bundle's frames as absolute paths: those prompt.md references (in the
-// order the walkthrough cites them) that exist, then any other image in the dir.
-async function collectImages(dir, promptMarkdown) {
-  const out = [];
-  const seen = new Set();
-  const add = (p) => {
-    const key = process.platform === 'win32' ? p.toLowerCase() : p;
-    if (!seen.has(key)) { seen.add(key); out.push(p); }
-  };
-  for (const m of promptMarkdown.matchAll(/!\[[^\]]*\]\(\s*<?([^)>]+?)>?\s*\)/g)) {
-    const p = path.resolve(dir, m[1]);
-    if (!IMAGE_EXT.has(path.extname(p).toLowerCase())) continue;
-    try {
-      if ((await fs.stat(p)).isFile()) add(p);
-    } catch { /* referenced but absent — skip */ }
-  }
-  const walk = async (d, depth) => {
-    let entries;
-    try {
-      entries = await fs.readdir(d, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-    for (const e of entries) {
-      const p = path.join(d, e.name);
-      if (e.isDirectory() && depth > 0) await walk(p, depth - 1);
-      else if (e.isFile() && IMAGE_EXT.has(path.extname(e.name).toLowerCase())) add(p);
-    }
-  };
-  await walk(dir, 1);
-  return out;
-}
-
-/**
- * The newest feedback bundle under baseDir, or null if there is none.
- * @returns {Promise<null|{id:string,dir:string,promptPath:string,promptMarkdown:string,imagePaths:string[]}>}
- */
-async function resolveLatest(baseDir = feedbackBaseDir()) {
-  const dir = (await fromPointer(baseDir)) || (await fromSymlink(baseDir)) || (await fromScan(baseDir));
-  if (!dir) return null;
-  const promptPath = path.join(dir, 'prompt.md');
-  const promptMarkdown = await fs.readFile(promptPath, 'utf8');
-  return {
-    id: path.basename(dir),
-    dir,
-    promptPath,
-    promptMarkdown,
-    imagePaths: await collectImages(dir, promptMarkdown),
-  };
-}
-
-function parseArgs(argv) {
-  const out = { json: false, base: undefined };
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '--json') out.json = true;
-    else if (a === '--base') out.base = argv[++i];
-    else if (a.startsWith('--base=')) out.base = a.slice('--base='.length);
-  }
-  return out;
-}
-
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
-  const baseDir = args.base || feedbackBaseDir();
-
-  const latest = await resolveLatest(baseDir);
-
-  if (!latest) {
-    if (args.json) {
-      process.stdout.write(`${JSON.stringify({ ok: false, reason: 'no_bundle', baseDir })}\n`);
-    } else {
-      process.stdout.write(
-        `No feedback bundle found under ${baseDir}.\n`
-        + 'Record a walkthrough in the Bongos app and stop the capture — that '
-        + 'writes a bundle here — then run /feedback again.\n',
-      );
-    }
-    return;
-  }
-
-  if (args.json) {
-    process.stdout.write(`${JSON.stringify({
-      ok: true,
-      id: latest.id,
-      dir: latest.dir,
-      promptPath: latest.promptPath,
-      imagePaths: latest.imagePaths,
-      promptMarkdown: latest.promptMarkdown,
-    }, null, 2)}\n`);
-    return;
-  }
-
-  const lines = [];
-  lines.push(`# Latest Bongos feedback bundle — ${latest.id}`);
-  lines.push(`# dir: ${latest.dir}`);
-  lines.push('');
-  lines.push('---- prompt.md ----');
-  lines.push('');
-  lines.push(latest.promptMarkdown.trimEnd());
-  lines.push('');
-  lines.push('---- attached frames (Read each path to see the screenshots) ----');
-  if (latest.imagePaths.length === 0) {
-    lines.push('(none — this session had no salient frames or markup)');
-  } else {
-    for (const p of latest.imagePaths) lines.push(p);
-  }
-  lines.push('');
-  process.stdout.write(`${lines.join('\n')}\n`);
-}
-
-module.exports = { resolveLatest, feedbackBaseDir };
-
-if (require.main === module) {
-  main().catch((err) => {
-    process.stderr.write(`feedback-latest: ${err.message}\n`);
-    process.exitCode = 1;
-  });
-}